WHAT IS CLAIMED IS : 

1 . A method for detecting misbehavior in a contention based communication 
network, this method comprising the steps of: 

recording at least some of invalid frames with their respective station 
identification issued by the stations accessing an Access Point, 

recording at least some of valid frames with their respective station 
identification issued by the stations accessing the Access Point, 

determining, for each station, a scrambled ratio based on the number of invalid 
frames and the number of valid frames, 

detecting a misbehavior station based on a station which has a substantially 
lower ratio than the other stations. 

2. The method of Claim 1, wherein the frames are the acknowledgment frames 
in a TCP/IP protocol. 

3. The method of Claim 1 or 2, further comprising the steps of: 

calculating an average scrambled ratio on the stations currently connected with 
the Access Point, 

setting a suspicious status in reference with a given station when the same has a 
scrambled ratio which is below of a predefined threshold value. 

4. The method of Claim 1 or 2, this method further comprising the steps of: 

calculating a first average scrambled ratio on all stations currently connected 
with the Access Point, 
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eliminating the stations for which the ratio is substantially higher than this first 
average scrambled ratio, 

calculating a second average scrambled ratio on the remaining stations, 

setting a suspicious status in reference with a given station when the same has a 
scrambled ratio which is below of a predefined threshold value. 

5. The method according to Claim 1, this method comprising the steps of: 

- analyzing the frames with their respective time stamp and station identification, 

- selecting a frame corresponding to an acknowledgment of a first station to the Access 
Point, 

- calculating a backoff time to a next frame sent by a second station, 

- comparing this backoff time with a lower limit and setting a suspicious status relative 
to the second station in case that the backoff time is smaller than the lower limit. 

6. The method according to Claim 5, wherein the suspicious status is a counter 
and each positive detection entails the increment of this counter, and in that, when this 
counter has reached a predefined threshold, the second station is considered as cheater. 

7. The method according to Claim 5 or 6, wherein it comprises the further 
steps of : 

- selecting a frame corresponding to an acknowledgment of the first station, 

- calculating the backoff time to the next frame of the second station, 

- successively storing the backoff times of the second station for a given period, 
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- determining the random character of the stored backoff times and considering the 
second station as cheater in case that the backoff times are not uniformly distributed in 
a predefined range. 

8. The method according to Claim 7, wherein it comprises the step of 
checking the presence of the maximum value of the range in the stored backoff times. 

9. The method according to Claim 7, wherein it comprises the steps of: 

- calculating an average backoff time over the stored backoff times for each station, 

- calculating an Access Point average value of the backoff times of the Access Point, 

- setting a suspicious status in reference with a given station when the same has an 
average backoff value smaller than the Access Point average backoff time value. 

10. The method according to Claims 5 or 6, wherein in case that the 
transmission of the second station is interleaved, the backoff time is calculated taking 
into account the sum of a first waiting time following the DIFS time while the 
interleaved station starts to transmit and a second waiting time while the second station 
starts to transmit. 

11. The method according to Claim 1, wherein it comprises the further steps 

of: 

- determining the number of retransmissions from the Access Point to each station, 

- determining the average number of retransmissions over a predefined period of time 
per station, 
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- setting a suspicious status in reference with a given station when the same has a 
number of retransmission substantially below the average number of retransmissions. 

12. The method according to Claim 1, wherein it comprises the further steps 

of: 

- determining the actual duration of a transmission for a given station, 

- comparing this duration with the declared NAV value in the RTS or DATA frames of 
this station, 

- setting a suspicious status in reference with this station in case that the actual 
duration is smaller than the declared value. 
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